⚡ TL;DR | Go Straight to the November 2026 Patch Tuesday Audit Report
Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The November 2026 edition of Patch Tuesday brings us 1094 fixes, with 63 rated as critical. We’ve listed the most important changes below.
CVE-2026-124194 is the one to patch first this month: it is the only vulnerability Microsoft flags as exploited in the wild. It is a spoofing flaw in Microsoft Outlook that affects Microsoft 365 Apps for Enterprise as well as Office LTSC 2021 and 2024. Microsoft rates it Moderate with a CVSS score of 6.5, so don’t let the label fool you.
An attacker can reach it over the network with low complexity and no privileges, but the user has to interact with something, such as opening a malicious message. The impact is on confidentiality, meaning sensitive information can be exposed. It has not been publicly disclosed, but active exploitation has been detected, which moves it straight to the top of the queue.
CVE-2026-118146 is a Critical remote code execution flaw in Windows Active Directory Domain Services, and CVE-2026-118148 is a Critical elevation of privilege flaw in the same component. Both are reachable over the network, require only low privileges, and need no user interaction. The RCE scores 8.8 with low attack complexity, while the elevation of privilege scores 7.5 with high attack complexity.
Both affect a wide range of supported Windows 10, Windows 11 and Windows Server releases, and Microsoft rates both as Exploitation More Likely. Neither is publicly disclosed or exploited yet. Together they describe a path from a low-privileged foothold to serious control of your directory, so treat your domain controllers accordingly.
CVE-2026-118207 is a Critical remote code execution vulnerability in Microsoft Exchange Server Subscription Edition. It carries a CVSS score of 8.8 and can be exploited over the network with low complexity and low privileges, without any user interaction. An attacker who gets code execution on an Exchange server is sitting on a very valuable box, which is why this one deserves attention.
Microsoft rates it Exploitation More Likely. It has not been publicly disclosed and is not known to be exploited yet.
To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.
The Lansweeper Patch Tuesday dashboard is available in our marketplace and is automatically kept up-to-date. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one dashboard, automatically updated.
Explore Lansweeper for free.
No credit card required.